Planet 49: Advocate General’s Opinion on Cookies and Consent Bundling (March 2019)
On 21 March, 2019 Advocate General Szpunar (“AG”) delivered an opinion on the rules applicable to cookies in relation to a case currently pending before the Court of Justice of the European Union (“CJEU”) (Case C-673/17).
In this case, Planet 49, a German registered company, hosted a lottery on its website. In order to participate in the lottery a participant had to deal with two check boxes. The first checkbox was not pre-ticked but it was mandatory for the participant to tick in order to participate in the lottery. The participant was giving consent to being sent various marketing emails. The second checkbox was pre-ticked and its purpose was for the participant to consent to having cookies put on their device for targeted ads. The participant could opt out of this at any time.
The federation of German consumer organisations took court proceedings against Planet 49 on the grounds that the consents did not satisfy the requirements of informed and freely given consent. Germany’s federal court of justice referred the case to the CJEU seeking guidance on provisions of the ePrivacy Directive (Directive 2002/58), the Data Protection Directive (Directive 95/46) and the GDPR (Regulation 2016/79). The key areas of interpretation by the AG in his opinion were (1) cookie consent and bundling of consent (2) the interplay of the e Privacy Directive and the GDPR (3) what information is required to be provided to a user for a consent to cookies to be valid.
Cookie Consent and Bundling of Consent
Article 4(11) of the GDPR defines consent as any freely given, specific, informed and unambiguous indication of the data subject’s wishes. The AG looked at the conditions for valid consent under both the Data Protection Directive and the GDPR and concluded there was no substantial difference between the two. He only noted that the GDPR is more explicit in laying down certain criteria.
The AG further concluded that for cookie consent to be freely given and informed, it must not only be active but also separate. In this case by ticking the check box, there was a bundled consent rather than separate consents for participating in the lottery and for accepting cookies. It must be the case that the act of consent cannot form part of another act, such as entering a lottery as in this case. He did however observe that the prohibition against bundling as set out in article 7(4) GDPR is not absolute (due to the wording “utmost account shall be taken thereof”). Article 7(4) provides that any assessment of whether consent is freely given should consider whether performance of a contract is conditioned on consent to process additional personal data not necessary to contract performance.
Interplay of the e Privacy Directive and the GDPR
The AG also formed the opinion that it is irrelevant to the referred questions whether cookies constitute personal data. This is because the relevant provision of the ePrivacy Directive, Article 5(3), regulates the storage and access of “information”, not just personal data. The scope of the GDPR does not therefore limit the scope of the ePrivacy Directive. This is relevant since organisations that rely on cookies should keep in mind that they are responsible for complying with the ePrivacy Directive in addition to the GDPR.
What information is required to be provided to a user for a consent to cookies to be valid.
In order to fulfil the transparency obligations under articles 13 and 14 GDPR, information about the duration of the cookie and any third-party access must be provided as must the identities of any third parties with access. Such information must be crystal clear without ambiguity as the average internet user would not be expected to know how cookies work.
What does this opinion mean?
It should be noted that this opinion is not binding on the court but such an opinion can be highly persuasive to the court. It may be that the court chooses not to address some of the questions raised and answered by the AG’s opinion for example the question around the bundling of consents; this will be interesting particularly in light of consents that are obtained by a user’s decision to continue accessing or use of a website. This may have an impact on how companies obtain cookie consent from users of their websites.